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1 This action is in response to the communication filed on 1/17/2007. 

2 DETAILED ACTION 

3 Continued Examination Under 3 7 CFR 1.114 

4 . 

5 A request for continued examination under 37 CFR 1.114, including the fee set forth in 

6 37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 

7 eligible for continued examination under 37 CFR 1 . 1 14, and the fee set forth in 37 CFR 1 . 1 7(e) 

8 has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 

9 37 CFR 1.114. Applicant's submission filed on 1/17/2007 has been entered. 

1 0 Response to Arguments 

1 1 Regarding applicants' argument that Hruska did not disclose a database of computer 

12 files, the examiner does not find the argument persuasive. In response to applicant's arguments 

13 against the references individually, one cannot show nonobviousness by attacking references 

14 individually where the rejections are based on combinations of references. See In re Keller, 642 

15 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 23 1 USPQ 375 

16 (Fed. Cir. 1986). In this case, the combination of Hruska and Le Pennec replaces the checksum 

17 database with the database of virus-free certificates which falls within the scope of "computer 

18 file". As such the examiner does not find the argument persuasive. 
19. ' 

20 Regarding the applicants' argument that the "number of hits" of Le Pennec does not fall 

21 within the scope of a "persistence flag", the examiner does not find the argument persuasive. 

22 . The claim requires that the "persistence flag" indicate whether an entry in the database should be 
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1 purged from said database during purge operations. The "number of hits" is used to determine 

2 which entries will be removed from the database during purging (when the database is full and a 

3 new entry is to be added). As such, the claim limitation is met, and the examiner does not find 

4 ' the argument persuasive. 
5 

6 In response to applicant's argument that the references fail to disclose wherein said 

7 database. . .from said computer file, the examiner does not find the argument persuasive. The 

8 examiner points out that Le Pennec does in fact teach the database having fields for "a filename 

9 of said computer file" as seen in Fig. 3 Element 305, "data identifying said requesting computer 

10 and a storage location of said computer file" as seen in Fig. 3 Element 304 and Col. 10 Lines 27- 

1 1 32, and "a checksum value calculated from said computer file" as seen in Fig. 5 Element 507. 

12 As such, the examiner does not find the argument persuasive. 

13 Claims 7-27, 34-54, and 61-81 have been examined. 

14 All objections and rejections not presented below have been withdrawn. 

1 5 Claim Rejections -35 JJSC §101 

16 35 U.S.C 101 reads as follows: 

1 7 Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 

1 8 any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 

1 9 requirements of this title. 

20 

21 Claims 7-27 are rejected under 35 U.S.C. 101 because the claimed invention is directed 

22 to non- statutory subject matter. The claims are directed towards a "computer program product". 

23 As a computer program listing falls within the scope of a computer program product, and a 

24 computer program listing is a computer program per se, a computer program product would 

25 include a computer program per se. A computer program per se is classified as Non-functional 
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1 Descriptive Language, and as such is not statutory. Therefore, the claims are rejected for failing 

2 to meet the statutory requirements of 35 USC 101. See MPEP § 2106JV.B.l(a). 
3 

4 

5 Claim Rejections - 35 USC §103 

6 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

7 obviousness rejections set forth in this Office action: 

8 A patent may not be obtained though the invention is not identically disclosed or 

9 described as set forth in section 102 of this title, if the differences between the subject matter 

1 0 sought to be patented and the prior art are such that the subject matter as a whole would have 

1 1 been obvious at the time the invention was made to a person having ordinary skill in the art to 

1 2 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

1 3 the invention was made. 
14 

15 Claims 7-13, 16-24, 27, 34-40, 43-51, 54, 61-67, 70-78, and 81 are rejected under 35 

16 U.S.C. 103(a) as being unpatentable over Hruska et al. (US Patent Number 6,195,587) 

17 hereinafter referred to as Hruska, and further in view of Le Pennec et al. (US Patent Number 

18 6,892,303) hereinafter referred to as Le Pennec. 

1 9 Regarding claims 7, and 17, Hruska disclosed a computer program product for 

20 controlling a computer to detect malware, said computer program product comprising (See 

21 Hruska Abstract and Col. 3 Lines 40-54 where it was implied that a computer program product 

22 was implemented in this system because the system relies on processors, which rely on computer 

23 programs): file access request detecting logic operable to detect a file access request to a 

24 computer file by a requesting computer (See Hruska Col. 3 lines 63-65); file access clearance 

25 request generating logic operable to generate a file access clearance request including data 
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1 identifying said computer file (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); file 

2 access clearance request transmitting logic operable to transmit said file access clearance request 

3 from said requesting computer to an assessment computer responsible for assessment of whether 

4 said computer file contains malware (See Hruska Col. 3 Lines 20-24 and Col. 4 Lines 20-23); 

5 file access clearance request receiving logic operable to receive at said assessment computer said 

6 file access clearance request from a requesting computer (See Hruska Col. 5 Lines 60-66); file 

7 access clearance response generating logic operable in dependence upon said data identifying 

8 said computer file to determine if said computer file has previously been assessed as not 

9 containing malware and to generate a file access clearance response (See Hruska Col. 5 Lines 3- 

10 10); file access clearance response transmitting logic operable to transmit said file access 

1 1 clearance response to said requesting computer (See Hruska Col 5 Lines 66-67); file access 

12 clearance response receiving logic operable to receive at said requesting computer said file 

13 access clearance response from said assessment computer (See Hruska Col. 4 Lines 45-52 and 

14 Col. 5 Lines 66-67 wherein it was implied that the requesting workstation received the report 

15 because the file server sent the report to the workstation and the workstation used the report); and 

16 file access permitting logic operable if said file access clearance response indicates said 

17 computer file does not contain malware to permit said file access request by said requesting 

18 computer (See Hruska Col. 4 Lines 45-52), and wherein said assessment computer stares a 

19 database of computer files including for each file a checksum of the file when last determined to 

20 be valid (See Hruska Col. 5 Lines 14-18 and 22-25), but Hruska failed to disclose wherein said 

21 database includes for each computer file a persistence flag indicating whether an entry relating to 

22 said computer file should be purged from said database during purge operations, or wherein said 
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1 database includes for each computer file fields specifying a filename of said computer file, and 

2 data identifying said requesting computer and a storage location of said computer file. 

3 Le Pennec teaches that in a virus detection system, in order to improve virus detection, a 

4 virus-free certificate should be associated with a file and stored in a database (See Le Pennec 

5 Col, 5 Lines 29-34 and Fig. 5 and associated text) as well as teaching that each certificate should 

6 have a hit count (511) which is used to determine if the certificate will be removed from the 

7 database upon adding a new certificate to a "full" database (See Le Pennec Fig. 7 and associated 

8 text), and a filename of said computer file (See Le Pennec Fig. 5 Element 504), and data 

9 identifying said requesting computer and a storage location of said computer file (See Le Pennec 

10 Fig. 3 Element 304). 

1 1 It would have been obvious to the ordinary person skilled in the art at the time of 

12 invention to employ the teachings of Le Pennec in the virus detection system of Hruska by 

13 utilizing the virus-free certificates in place of the checksums of Hruska. This would have been 

14 obvious because the ordinary person skilled in the art would have been motivated to improve 

15 upon the virus detection of Hruska. 

16 Regarding claims 8, and 18, Hruska and Le Pennec disclosed that said data identifying 

17 said computer file includes a checksum value calculated from said computer file (See Hruska 

18 Col. 3 Lines 1-3 and Col. 4 Lines 13-16 and Le Pennec Fig. 5). 

19 Regarding claims 9, and 19, Hruska and Le Pennec disclosed that said data identifying 

20 said computer file includes one or more of a filename of said computer file, data identifying said 

21 requesting computer and a storage location of said computer file (See Hruska Col. 5 Lines 43-48, 

22 and 51-56 and Le Pennec Fig. 5). 
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1 Regarding claims 10, and 20, Hruska and Le Pennec disclosed that if said file access 

2 clearance response indicates a scan of said computer file is required by said assessment 

3 computer, then computer file transmitting logic is operable to transmit said computer file from 

4 said requesting computer to said assessment computer, receiving at said assessment computer 

5 said computer file from said requesting computer and performing a malware scan of said 

6 computer file (See Hruska Col. 4 Lines 20-23 and 26-40 and Col. 5 lines 10-13). 



7 Regarding claims 1 1 and 21, Hruska and Lei Pennec disclosed that if said file access 

8 clearance response indicates access to said computer file is denied, then triggering a denied 

9 access response in said assessment computer (See Hruska Col. 5 Lines 18-22). 

10 Regarding claim 22, Hruska and Le Pennec disclosed that if said file access clearance 

1 1 response indicates access to said computer file is denied, then triggering a denied access 

12 response in said requesting computer (See Hruska Col. 4 Lines 52-55). 

13 Regarding claims 12 and 23, Hruska and Le Pennec disclosed that said assessment 

14 computer stores a database of computer files previously assessed as to whether they contain 

15 malware (See Hruska Col. 5 Lines 14-18). 

16 Regarding claims 13 and 24, Hruska and Le Pennec disclosed that said database further 

17 includes for each computer file another field specifying an access flag indicating whether access 

18 to said computer file is denied (See Hruska Col. 5 Lines 14-18 and 22-25). 

19 Regarding claims 16, and 27, Hruska and Le Pennec disclosed that a plurality of 

20 requesting computers share access to an assessment computer for determining whether file 

21 access requests by those requesting computers should be denied (See Col. 5 Lines 26-40). 
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1 Claims 34-40, 43-51, and 54 are rejected for the same reasons as claims 7-13, 16-24, and 

2 27 respectively, and further because Hruska disclosed the method of the above rejected claims 

3 (See Hruska Abstract). 

4 Claims 61-67, 70-78, and 81 are rejected for the same reasons as claims 7-13, 16-24, and 

5 27 respectively, and further because Hruska disclosed the system of the above rejected claims 

6 (See Hruska Abstract). 
7 

8 Claims 14-15, 25-26, 41-42, 52-53, 68-69, and 79-80 are rejected under 35 U.S.C. 103(a) 

9 as being unpatentable over Hruska and Le Pennec as applied to claims 7, 17, 34, 44, 61, and 71 

10 above respectively, and further in view of Caccavale (US Patent Application Publication Number 

11 2002/0129277). 

12 Hruska and Le Pennec disclosed denying access to files in the event that they contain 

13 characteristic forms of viruses (See Col. 1 Lines 62-65 and Col. 4 Lines 45-55), but failed to 

14 disclose a message being sent to the file server indicating a switch to a mode of operation 



15 wherein more files are denied for access. Hruska does, however, disclose that a user can indicate 

16 that all files need to be checked by the file server regardless of prior results (See Hruska Col. 4 

17 Lines 55-57). 

18 Caccavale teaches that it is often the case that a virus checker program is unable to detect 

19 a new virus (See Caccavale Paragraph 0075 Lines 1-2). Caccavale further teaches that in such a 

20 case, an updated anti-virus pattern file should be distributed to the virus checker program, at 

21 which point all the files can be marked as unchecked in order for all the files to be checked for 

22 the new virus using the new pattern (See Hruska Paragraph 0075). 
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It would have been obvious to the ordinary person skilled in the art at the time of 



2 invention to employ the teachings of Caccavale in the file checking system of Hruska and Le 

3 Pennec by sending new anti-virus patterns to the file server, and in response to receiving the new 

4 pattern, marking all the files as unchecked and needing to be scanned. This would have been 

5 obvious because the ordinary person skilled in the art would have been motivated to protect the 

6 workstations from files containing new viruses that the file server did not know of when the file 

7 was originally scanned. In this manner, the fileserver would rescan all the files with a greater 

8 likelihood of finding a virus and therefore denying access to more files. 



9 



10 



11 



12 



13 



Conclusion 



14 



Claims 7-27, 34-54, and 61-81 have been rejected. 



15 



16 
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